Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

101–110 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#101

Post by ExpertAdvisor01 »

hyghjiyhu wrote: post #79
cons0le wrote: post #65

Earlier quoted context omitted.

Yep, hardware attestation is becomming more common, even with websites. This is why LineageOS is actually dead in the water, even though they're "in talks with hardware vendors". It doesn't matter when people can't use the apps and services they need.

A solution could be having a tiny non-rooted Android system as a "coprocessor".

This won't work. The tiny non-rooted system wouldn't get certified by Google and therefore not pass hardware attestation, which most banking apps use.

Re: The Vietnam government has banned rooted phones from using any banking app

#102

Post by TZubiri »

fenaer wrote: post #20

Unfortunately the answer here is to not abide by the law. If there is a reasonable way to bypass this (as the cat-and-mouse game always seems to continue), and there is reasonable expectation to not be caught, then I see no moral quandary with ignoring such a consumer-hostile rule.

I'm assuming you would do this out of a political reason, or as a very technical and privacy aware user.

But you are providing an alibi for malicious users who, for example, might try to brute force logins from unidentified devices.

That would be one reason aside from the law. You are essentially positioning yourself on the same side as intruders.

Re: The Vietnam government has banned rooted phones from using any banking app

#103

Post by basilikum »

baal80spam wrote: post #17
taosx wrote: post #5

I really don't understand this. My line of thinking is that if someone is technical enough to root his phone he understands the risks. Why would they force banking apps to detect and not work on rooted phones? Why would the government care so much?

> Why would the government care so much? My guess is: 1. Person with rooted phone uses a bank app, is hacked, has their money stolen. 2. Guess where the person turns to for help? The government.

I don't think this is actually happening. There is an enormous loss to scams mostly by tech illiterate people using the preinstalled operating system. I don't think the losses that involve user installed OSes are in any way significant.

Re: The Vietnam government has banned rooted phones from using any banking app

#104

Post by adrr »

lenerdenator wrote: post #80
adrr wrote: post #77

Earlier quoted context omitted.

Bunch of fintechs only let your signup from an app. Easier to secure and prevent bots. Pin certs, detect virtualization, etc.

And, of course, easier to get the valuable data about the person setting up an account.

Like what data? Curious because I built and launched a challenger bank.

Re: The Vietnam government has banned rooted phones from using any banking app

#105

Post by alephnerd »

grugdev42 wrote: post #9

Serious question, what is gained from this move? Why would a government care? Are rooted phones really that much of a problem? Surely most people running a rooted phone are tech enthusiasts. Cybercriminals will just use regular phones bought under false names and dispose of them afterwards.

> Why would a government care

Viet Nam is in the process of rolling out mandatory biometric identification and verification as part of the VNeID project [0], and mobile operators are in the process of rolling out identity stamping if mobile devices using VNeID [1]

Viet Nam is also an authoritarian state who's current leader (To Lam) spent his entire career in Viet Nam's KGB (MPS/BCA). Unlike Westerners, Vietnamese know the red lines - this is why I and my SO (much to her chagrin due to my insistence) never travel back to VN with my personal accounts or devices, and why we keep some friends of friends on speed dial.

[0] - https://vneid.gov.vn/

[1] - https://vtv.vn/nha-mang-ho-tro-kich-hoat-sim-truc-tuyen-bang...

Re: The Vietnam government has banned rooted phones from using any banking app

#106

Post by Helmut10001 »

Fiveplus wrote: post #82

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…

As I mentioned in another post: By 2026, you'll need two phones. My current setup:

    1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it.

    2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access.
This is expensive, but I found it to be the only viable solution to this problem.

Re: The Vietnam government has banned rooted phones from using any banking app

#107

Post by pixl97 »

jack_pp wrote: post #95
jdiff wrote: post #85

Earlier quoted context omitted.

Rooted devices don't enable that transaction. That's all social engineering.

and grandmas don't root their devices.

As a devils advocate grandma would have no idea if she was buying or got her device rooted by someone else.

Re: The Vietnam government has banned rooted phones from using any banking app

#108

Post by ecshafer »

simlevesque wrote: post #58
dingaling wrote: post #8

Earlier quoted context omitted.

Eventually though I suspect that web access to banks will be rescinded too, much like HMRC in the UK no longer permits companies to submit their taxes through the websites. In the future, everything will need an 'app'.

First it'll be apps , then it'll be one app .

China is ahead of the curve here, the one app is wechat.

Re: The Vietnam government has banned rooted phones from using any banking app

#109

Post by xandrius »

TZubiri wrote: post #94
curt15 wrote: post #83

>The Vietnam government has banned rooted phones from using any banking app The Vietnam government has banned phones under their user's control from using any banking app.

If the banking apps have a Terms of Service, you are free not to use the banking app. To give a specific example, suppose a banking app wants to require location services in order to try to login. Some users can bypass or spoof this, (in fact that's what the thread is about entirely, and for that they root the phones. Not all users who root the phones violate ToS, but it's a majority, or even a possibility, so they c…

Yep, you are also free not to have a phone. But good luck living in our current times.

Re: The Vietnam government has banned rooted phones from using any banking app

#110

Post by whs »

Arbortheus wrote: post #4

Do those same banks have websites that you can access from a computer with root access? Most likely, yes.

Thai banks are required by regulation to have facial recognition when transferring over 50k THB in one transaction or cumulative in a day. I believe most banks have shutdown their internet banking as it's not worth it for the low number of users to implement web-based secure facial recognition that don't allow you to feed spoofed video input. One of the bank that I use will send a push notification to their mobile app for you to confirm the transaction.

I believe that previously internet banking, even before mobile banking, will limit the number of transfer recipients you can add per day/month. With the rise of QR payment I could see this limit being regularly hit if you scrape the web-based banking.

Since the Bank of Thailand claims that they technically don't block many things (mobile banking technical requirements seems to also require blocking root, but they never banned internet banking), I wish there's a new bank that try to disrupt the existing players. But the latest "branchless" banking license were only acquired by existing banking groups, so API-first personal banking remain impossible.

Post reply on HN